AI Trajectory

null

{
  "EnableConfigs": [
    "MEMCG"
  ],
  "FocusSymbols": [
    "memory_high_write",
    "memory_max_write",
    "user_proactive_reclaim"
  ],
  "Reasoning": "The patch adds checks for `memcg_is_dying(memcg)` in `memory_high_write`, `memory_max_write` (in mm/memcontrol.c), and `user_proactive_reclaim` (in mm/vmscan.c). These functions are reachable via cgroupfs writes (`memory.high`, `memory.max`, `memory.reclaim`) and sysfs writes (`reclaim`). The changes are functional as they alter the execution flow by breaking out of loops if the memory cgroup is dying. The code is guarded by CONFIG_MEMCG, which needs to be enabled.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 7fd5bdd2093fd186d01eb449dedf5ebd7dddceb8\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jun 23 06:55:10 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/mm/memcontrol.c b/mm/memcontrol.c\nindex 56cd4af082326b..06bde6c5318f2b 100644\n--- a/mm/memcontrol.c\n+++ b/mm/memcontrol.c\n@@ -4793,6 +4793,9 @@ static ssize_t memory_high_write(struct kernfs_open_file *of,\n \t\tif (signal_pending(current))\n \t\t\tbreak;\n \n+\t\tif (memcg_is_dying(memcg))\n+\t\t\tbreak;\n+\n \t\tif (!drained) {\n \t\t\tdrain_all_stock(memcg);\n \t\t\tdrained = true;\n@@ -4844,6 +4847,9 @@ static ssize_t memory_max_write(struct kernfs_open_file *of,\n \t\tif (signal_pending(current))\n \t\t\tbreak;\n \n+\t\tif (memcg_is_dying(memcg))\n+\t\t\tbreak;\n+\n \t\tif (!drained) {\n \t\t\tdrain_all_stock(memcg);\n \t\t\tdrained = true;\ndiff --git a/mm/vmscan.c b/mm/vmscan.c\nindex 8190c4abec8418..1162b7f76655e9 100644\n--- a/mm/vmscan.c\n+++ b/mm/vmscan.c\n@@ -7922,6 +7922,9 @@ int user_proactive_reclaim(char *buf,\n \t\tif (memcg) {\n \t\t\tunsigned int reclaim_options;\n \n+\t\t\tif (memcg_is_dying(memcg))\n+\t\t\t\tbreak;\n+\n \t\t\treclaim_options = MEMCG_RECLAIM_MAY_SWAP |\n \t\t\t\t\t  MEMCG_RECLAIM_PROACTIVE;\n \t\t\treclaimed = try_to_free_mem_cgroup_pages(memcg,\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "MEMCG"
  ],
  "FocusSymbols": [
    "memory_high_write",
    "memory_max_write",
    "user_proactive_reclaim"
  ],
  "Reasoning": "The patch adds checks for `memcg_is_dying(memcg)` in `memory_high_write`, `memory_max_write` (in mm/memcontrol.c), and `user_proactive_reclaim` (in mm/vmscan.c). These functions are reachable via cgroupfs writes (`memory.high`, `memory.max`, `memory.reclaim`) and sysfs writes (`reclaim`). The changes are functional as they alter the execution flow by breaking out of loops if the memory cgroup is dying. The code is guarded by CONFIG_MEMCG, which needs to be enabled.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 7fd5bdd2093fd186d01eb449dedf5ebd7dddceb8
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jun 23 06:55:10 2026 +0000

    syz-cluster: applied patch under review

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 56cd4af082326b..06bde6c5318f2b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4793,6 +4793,9 @@ static ssize_t memory_high_write(struct kernfs_open_file *of,
 		if (signal_pending(current))
 			break;
 
+		if (memcg_is_dying(memcg))
+			break;
+
 		if (!drained) {
 			drain_all_stock(memcg);
 			drained = true;
@@ -4844,6 +4847,9 @@ static ssize_t memory_max_write(struct kernfs_open_file *of,
 		if (signal_pending(current))
 			break;
 
+		if (memcg_is_dying(memcg))
+			break;
+
 		if (!drained) {
 			drain_all_stock(memcg);
 			drained = true;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8190c4abec8418..1162b7f76655e9 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -7922,6 +7922,9 @@ int user_proactive_reclaim(char *buf,
 		if (memcg) {
 			unsigned int reclaim_options;
 
+			if (memcg_is_dying(memcg))
+				break;
+
 			reclaim_options = MEMCG_RECLAIM_MAY_SWAP |
 					  MEMCG_RECLAIM_PROACTIVE;
 			reclaimed = try_to_free_mem_cgroup_pages(memcg,

gemini-3.1-pro-preview

null

null

							input: 2110
							output: 21
							thoughts: 287
						

**Analyzing the Proposed Memory Controller Patch**

Okay, so this patch is touching `mm/memcontrol.c` and `mm/vmscan.c`. Interesting. It looks like the core change is the addition of `if (memcg_is_dying(memcg)) break;` in three spots. Let's see... the first two are in `memory_high_write` and `memory_max_write`, both in `mm/memcontrol.c`. Right, those are the cgroup v2 handlers for `memory.high` and `memory.max`, the memory limits. And the third instance is in `user_proactive_reclaim` which is also in `mm/vmscan.c`, so that's the handler for the `memory.reclaim` control file in the cgroup v2 memory controller. Makes sense, that's where you'd expect to see these kinds of checks.

Now, what about `memcg_is_dying`? Ah, it's not defined in the patch itself, so it must be something pre-existing. Is it `mem_cgroup_is_dying` or just `memcg_is_dying`? The patch says `memcg_is_dying`. Is this a macro or a function? It should be in `mm/memcontrol.c` or `include/linux/memcontrol.h`, probably. Let's look there to understand what it means for a memory control group to be "dying" and why we're breaking out of these write handlers when that's the case. That's the key.

{
  "Expression": "memcg_is_dying"
}

{
  "Output": "include/linux/memcontrol.h=1763=void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);\ninclude/linux/memcontrol.h-1764-\ninclude/linux/memcontrol.h:1765:static inline bool memcg_is_dying(struct mem_cgroup *memcg)\ninclude/linux/memcontrol.h-1766-{\n--\ninclude/linux/memcontrol.h=1837=static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-1840-\ninclude/linux/memcontrol.h:1841:static inline bool memcg_is_dying(struct mem_cgroup *memcg)\ninclude/linux/memcontrol.h-1842-{\n--\nmm/memcontrol.c=808=static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg,\n--\nmm/memcontrol.c-819-\nmm/memcontrol.c:820:\twhile (memcg_is_dying(memcg))\nmm/memcontrol.c-821-\t\tmemcg = parent_mem_cgroup(memcg);\n--\nmm/memcontrol.c=4767=static ssize_t memory_high_write(struct kernfs_open_file *of,\n--\nmm/memcontrol.c-4795-\nmm/memcontrol.c:4796:\t\tif (memcg_is_dying(memcg))\nmm/memcontrol.c-4797-\t\t\tbreak;\n--\nmm/memcontrol.c=4822=static ssize_t memory_max_write(struct kernfs_open_file *of,\n--\nmm/memcontrol.c-4849-\nmm/memcontrol.c:4850:\t\tif (memcg_is_dying(memcg))\nmm/memcontrol.c-4851-\t\t\tbreak;\n--\nmm/vmscan.c=7866=int user_proactive_reclaim(char *buf,\n--\nmm/vmscan.c-7924-\nmm/vmscan.c:7925:\t\t\tif (memcg_is_dying(memcg))\nmm/vmscan.c-7926-\t\t\t\tbreak;\n"
}

gemini-3.1-pro-preview

null

null

							input: 3081
							output: 59
							thoughts: 169
						

**Analyzing the New Memcg Dying Checks**

Okay, so this patch introduces `memcg_is_dying(memcg)` checks within the memory management subsystem. Specifically, it targets `memory_high_write`, `memory_max_write`, and `user_proactive_reclaim`. Right away, I see these are all crucial functions dealing with cgroup memory limits and proactive reclaim, which are areas I'm intimately familiar with. The first two, `memory_high_write` and `memory_max_write`, are defined in `mm/memcontrol.c`, and `user_proactive_reclaim` resides in `mm/vmscan.c`.

My immediate next step is to examine the relevant Kconfig options. `mm/memcontrol.c`, as expected, is conditionally compiled based on `CONFIG_MEMCG`. This tells me that the checks within it are part of the core memcg functionality. `mm/vmscan.c` is always included, but I'll need to double-check whether the inclusion of `user_proactive_reclaim` is specifically guarded by `CONFIG_MEMCG` or some other dependent configuration. It's important to understand the overall compilation context to determine exactly how the patch will behave across different system configurations. This is a standard analysis I perform when reviewing memory management changes.

{
  "Expression": "memory_high_write"
}

{
  "Output": "mm/memcontrol.c=4761=static int memory_high_show(struct seq_file *m, void *v)\n--\nmm/memcontrol.c-4766-\nmm/memcontrol.c:4767:static ssize_t memory_high_write(struct kernfs_open_file *of,\nmm/memcontrol.c-4768-\t\t\t\t char *buf, size_t nbytes, loff_t off)\n--\nmm/memcontrol.c=5007=static struct cftype memory_files[] = {\n--\nmm/memcontrol.c-5036-\t\t.seq_show = memory_high_show,\nmm/memcontrol.c:5037:\t\t.write = memory_high_write,\nmm/memcontrol.c-5038-\t},\n"
}

{
  "Expression": "memory_max_write"
}

{
  "Output": "mm/memcontrol.c=4816=static int memory_max_show(struct seq_file *m, void *v)\n--\nmm/memcontrol.c-4821-\nmm/memcontrol.c:4822:static ssize_t memory_max_write(struct kernfs_open_file *of,\nmm/memcontrol.c-4823-\t\t\t\tchar *buf, size_t nbytes, loff_t off)\n--\nmm/memcontrol.c=5007=static struct cftype memory_files[] = {\n--\nmm/memcontrol.c-5042-\t\t.seq_show = memory_max_show,\nmm/memcontrol.c:5043:\t\t.write = memory_max_write,\nmm/memcontrol.c-5044-\t},\n"
}

{
  "Expression": "user_proactive_reclaim"
}

{
  "Output": "mm/internal.h=624=extern void reclaim_throttle(pg_data_t *pgdat, enum vmscan_throttle_state reason);\nmm/internal.h:625:int user_proactive_reclaim(char *buf,\nmm/internal.h-626-\t\t\t   struct mem_cgroup *memcg, pg_data_t *pgdat);\n--\nmm/memcontrol.c=4994=static ssize_t memory_reclaim(struct kernfs_open_file *of, char *buf,\n--\nmm/memcontrol.c-4999-\nmm/memcontrol.c:5000:\tret = user_proactive_reclaim(buf, memcg, NULL);\nmm/memcontrol.c-5001-\tif (ret)\n--\nmm/vmscan.c=7860=static const match_table_t tokens = {\n--\nmm/vmscan.c-7865-\nmm/vmscan.c:7866:int user_proactive_reclaim(char *buf,\nmm/vmscan.c-7867-\t\t\t   struct mem_cgroup *memcg, pg_data_t *pgdat)\n--\nmm/vmscan.c=8012=static ssize_t reclaim_store(struct device *dev,\n--\nmm/vmscan.c-8017-\nmm/vmscan.c:8018:\tret = user_proactive_reclaim((char *)buf, NULL, NODE_DATA(nid));\nmm/vmscan.c-8019-\treturn ret ? -EAGAIN : count;\n"
}

gemini-3.1-pro-preview

null

null

							input: 4251
							output: 18
							thoughts: 224
						

**Analyzing a Memory Management Patch**

Okay, so I'm looking at this patch that introduces `if (memcg_is_dying(memcg)) break;` into a few key memory management functions: `memory_high_write`, `memory_max_write`, and `user_proactive_reclaim`. Right away, my expert intuition is engaged; these are core functions. They're all triggered by writes to cgroupfs files: `memory.high`, `memory.max`, and `memory.reclaim`, or indirectly through sysfs `reclaim` for nodes. This impacts the critical execution flow related to cgroup memory limits and the proactive reclaim mechanisms. That makes it immediately interesting from a security perspective – reachable via cgroupfs is a big red flag. The patch author even flagged it as WorthFuzzing=true. I agree, based on my understanding of the system's architecture, there's a strong potential for unexpected behavior, edge cases, and potentially vulnerabilities with concurrent access.

Let's drill down a bit further. `memory_high_write` and `memory_max_write` are clearly in `mm/memcontrol.c` and `user_proactive_reclaim` is in `mm/vmscan.c`. I need to review those sections of code. And obviously, the `MEMCG` configuration option is enabled. I should check if this patch depends on any other configs, even if I don't see any obvious ones yet. This looks like a definite candidate for in-depth analysis.

{
  "Expression": "CONFIG_MEMCG"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1204 lines.\nUse more precise expression if possible.\n\nDocumentation/admin-guide/cgroup-v1/memory.rst=405=To use the user interface:\nDocumentation/admin-guide/cgroup-v1/memory.rst-406-\nDocumentation/admin-guide/cgroup-v1/memory.rst:407:1. Enable CONFIG_CGROUPS and CONFIG_MEMCG options\nDocumentation/admin-guide/cgroup-v1/memory.rst-408-2. Prepare the cgroups (see :ref:`Why are cgroups needed?\n--\nDocumentation/admin-guide/mm/pagemap.rst=65=number of times a page is mapped.\n--\nDocumentation/admin-guide/mm/pagemap.rst-101-   memory cgroup each page is charged to, indexed by PFN. Only available when\nDocumentation/admin-guide/mm/pagemap.rst:102:   CONFIG_MEMCG is set.\nDocumentation/admin-guide/mm/pagemap.rst-103-\n--\nDocumentation/admin-guide/mm/shrinker_debugfs.rst=17=Usage:\n--\nDocumentation/admin-guide/mm/shrinker_debugfs.rst-58-\nDocumentation/admin-guide/mm/shrinker_debugfs.rst:59:  If the shrinker is not memcg-aware or CONFIG_MEMCG is off, 0 is printed\nDocumentation/admin-guide/mm/shrinker_debugfs.rst-60-  as cgroup inode id. If the shrinker is not numa-aware, 0's are printed\n--\narch/arm/configs/omap2plus_defconfig=11=CONFIG_CGROUPS=y\narch/arm/configs/omap2plus_defconfig:12:CONFIG_MEMCG=y\narch/arm/configs/omap2plus_defconfig-13-CONFIG_BLK_CGROUP=y\n--\narch/arm64/configs/defconfig=17=CONFIG_NUMA_BALANCING=y\narch/arm64/configs/defconfig:18:CONFIG_MEMCG=y\narch/arm64/configs/defconfig-19-CONFIG_BLK_CGROUP=y\n--\narch/loongarch/configs/loongson32_defconfig=20=CONFIG_LOG_BUF_SHIFT=18\narch/loongarch/configs/loongson32_defconfig:21:CONFIG_MEMCG=y\narch/loongarch/configs/loongson32_defconfig-22-CONFIG_BLK_CGROUP=y\n--\narch/loongarch/configs/loongson64_defconfig=23=CONFIG_NUMA_BALANCING=y\narch/loongarch/configs/loongson64_defconfig:24:CONFIG_MEMCG=y\narch/loongarch/configs/loongson64_defconfig-25-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/ci20_defconfig=11=CONFIG_CGROUPS=y\narch/mips/configs/ci20_defconfig:12:CONFIG_MEMCG=y\narch/mips/configs/ci20_defconfig-13-CONFIG_CGROUP_SCHED=y\n--\narch/mips/configs/cu1000-neo_defconfig=8=CONFIG_CGROUPS=y\narch/mips/configs/cu1000-neo_defconfig:9:CONFIG_MEMCG=y\narch/mips/configs/cu1000-neo_defconfig-10-CONFIG_CGROUP_SCHED=y\n--\narch/mips/configs/cu1830-neo_defconfig=8=CONFIG_CGROUPS=y\narch/mips/configs/cu1830-neo_defconfig:9:CONFIG_MEMCG=y\narch/mips/configs/cu1830-neo_defconfig-10-CONFIG_CGROUP_SCHED=y\n--\narch/mips/configs/db1xxx_defconfig=10=CONFIG_CGROUPS=y\narch/mips/configs/db1xxx_defconfig:11:CONFIG_MEMCG=y\narch/mips/configs/db1xxx_defconfig-12-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/eyeq5_defconfig=7=CONFIG_IKCONFIG_PROC=y\narch/mips/configs/eyeq5_defconfig:8:CONFIG_MEMCG=y\narch/mips/configs/eyeq5_defconfig-9-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/eyeq6_defconfig=7=CONFIG_IKCONFIG_PROC=y\narch/mips/configs/eyeq6_defconfig:8:CONFIG_MEMCG=y\narch/mips/configs/eyeq6_defconfig-9-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/eyeq6lplus_defconfig=7=CONFIG_IKCONFIG_PROC=y\narch/mips/configs/eyeq6lplus_defconfig:8:CONFIG_MEMCG=y\narch/mips/configs/eyeq6lplus_defconfig-9-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/generic_defconfig=4=CONFIG_IKCONFIG_PROC=y\narch/mips/configs/generic_defconfig:5:CONFIG_MEMCG=y\narch/mips/configs/generic_defconfig-6-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/loongson2k_defconfig=14=CONFIG_TASK_IO_ACCOUNTING=y\narch/mips/configs/loongson2k_defconfig:15:CONFIG_MEMCG=y\narch/mips/configs/loongson2k_defconfig-16-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/loongson3_defconfig=16=CONFIG_TASK_IO_ACCOUNTING=y\narch/mips/configs/loongson3_defconfig:17:CONFIG_MEMCG=y\narch/mips/configs/loongson3_defconfig-18-CONFIG_BLK_CGROUP=y\n--\narch/mips/configs/omega2p_defconfig=10=CONFIG_CGROUPS=y\narch/mips/configs/omega2p_defconfig:11:CONFIG_MEMCG=y\narch/mips/configs/omega2p_defconfig-12-CONFIG_CGROUP_SCHED=y\n--\narch/mips/configs/vocore2_defconfig=10=CONFIG_CGROUPS=y\narch/mips/configs/vocore2_defconfig:11:CONFIG_MEMCG=y\narch/mips/configs/vocore2_defconfig-12-CONFIG_CGROUP_SCHED=y\n--\narch/parisc/configs/generic-64bit_defconfig=15=CONFIG_CGROUPS=y\narch/parisc/configs/generic-64bit_defconfig:16:CONFIG_MEMCG=y\narch/parisc/configs/generic-64bit_defconfig-17-CONFIG_CGROUP_PIDS=y\n--\narch/powerpc/configs/powernv_defconfig=18=CONFIG_CGROUPS=y\narch/powerpc/configs/powernv_defconfig:19:CONFIG_MEMCG=y\narch/powerpc/configs/powernv_defconfig-20-CONFIG_CGROUP_SCHED=y\n--\narch/powerpc/configs/ppc64_defconfig=22=CONFIG_NUMA_BALANCING=y\narch/powerpc/configs/ppc64_defconfig:23:CONFIG_MEMCG=y\narch/powerpc/configs/ppc64_defconfig-24-CONFIG_BLK_CGROUP=y\n--\narch/riscv/configs/defconfig=8=CONFIG_CGROUPS=y\narch/riscv/configs/defconfig:9:CONFIG_MEMCG=y\narch/riscv/configs/defconfig-10-CONFIG_BLK_CGROUP=y\n--\narch/s390/configs/debug_defconfig=24=CONFIG_NUMA_BALANCING=y\narch/s390/configs/debug_defconfig:25:CONFIG_MEMCG=y\narch/s390/configs/debug_defconfig-26-CONFIG_BLK_CGROUP=y\n--\narch/s390/configs/defconfig=22=CONFIG_NUMA_BALANCING=y\narch/s390/configs/defconfig:23:CONFIG_MEMCG=y\narch/s390/configs/defconfig-24-CONFIG_BLK_CGROUP=y\n--\narch/xtensa/configs/audio_kc705_defconfig=12=CONFIG_CGROUP_CPUACCT=y\narch/xtensa/configs/audio_kc705_defconfig:13:CONFIG_MEMCG=y\narch/xtensa/configs/audio_kc705_defconfig-14-CONFIG_NAMESPACES=y\n--\narch/xtensa/configs/generic_kc705_defconfig=12=CONFIG_CGROUP_CPUACCT=y\narch/xtensa/configs/generic_kc705_defconfig:13:CONFIG_MEMCG=y\narch/xtensa/configs/generic_kc705_defconfig-14-CONFIG_NAMESPACES=y\n--\narch/xtensa/configs/nommu_kc705_defconfig=12=CONFIG_CGROUP_CPUACCT=y\narch/xtensa/configs/nommu_kc705_defconfig:13:CONFIG_MEMCG=y\narch/xtensa/configs/nommu_kc705_defconfig-14-CONFIG_NAMESPACES=y\n--\narch/xtensa/configs/smp_lx200_defconfig=12=CONFIG_CGROUP_CPUACCT=y\narch/xtensa/configs/smp_lx200_defconfig:13:CONFIG_MEMCG=y\narch/xtensa/configs/smp_lx200_defconfig-14-CONFIG_NAMESPACES=y\n--\narch/xtensa/configs/virt_defconfig=7=CONFIG_BSD_PROCESS_ACCT=y\narch/xtensa/configs/virt_defconfig:8:CONFIG_MEMCG=y\narch/xtensa/configs/virt_defconfig-9-CONFIG_CGROUP_FREEZER=y\n--\narch/xtensa/configs/xip_kc705_defconfig=7=CONFIG_BSD_PROCESS_ACCT=y\narch/xtensa/configs/xip_kc705_defconfig:8:CONFIG_MEMCG=y\narch/xtensa/configs/xip_kc705_defconfig-9-CONFIG_CGROUP_FREEZER=y\n--\nblock/blk-cgroup.c=1556=struct cgroup_subsys io_cgrp_subsys = {\n--\nblock/blk-cgroup.c-1565-\t.exit = blkcg_exit,\nblock/blk-cgroup.c:1566:#ifdef CONFIG_MEMCG\nblock/blk-cgroup.c-1567-\t/*\n--\ndrivers/acpi/scan.c=204=static int acpi_scan_try_to_offline(struct acpi_device *device)\n--\ndrivers/acpi/scan.c-212-\t * because if the devices in question are memory blocks and\ndrivers/acpi/scan.c:213:\t * CONFIG_MEMCG is set, one of the blocks may hold data structures\ndrivers/acpi/scan.c-214-\t * that the other blocks depend on, but it is not known in advance which\n--\ndrivers/block/loop.c=1851=static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,\n--\ndrivers/block/loop.c-1879-\t\tcmd-\u003eblkcg_css = bio_blkcg_css(rq-\u003ebio);\ndrivers/block/loop.c:1880:#ifdef CONFIG_MEMCG\ndrivers/block/loop.c-1881-\t\tif (cmd-\u003eblkcg_css) {\n--\ndrivers/iommu/iommu-pages.c=19=IOPTDESC_MATCH(_refcount, __page_refcount);\ndrivers/iommu/iommu-pages.c:20:#ifdef CONFIG_MEMCG\ndrivers/iommu/iommu-pages.c-21-IOPTDESC_MATCH(memcg_data, memcg_data);\n--\ndrivers/iommu/iommu-pages.h=19=struct ioptdesc {\n--\ndrivers/iommu/iommu-pages.h-31-\tatomic_t __page_refcount;\ndrivers/iommu/iommu-pages.h:32:#ifdef CONFIG_MEMCG\ndrivers/iommu/iommu-pages.h-33-\tunsigned long memcg_data;\n--\nfs/proc/page.c=271=static const struct proc_ops kpageflags_proc_ops = {\n--\nfs/proc/page.c-276-\nfs/proc/page.c:277:#ifdef CONFIG_MEMCG\nfs/proc/page.c-278-static ssize_t kpagecgroup_read(struct file *file, char __user *buf,\n--\nfs/proc/page.c=283=static const struct proc_ops kpagecgroup_proc_ops = {\n--\nfs/proc/page.c-287-};\nfs/proc/page.c:288:#endif /* CONFIG_MEMCG */\nfs/proc/page.c-289-\nfs/proc/page.c=290=static int __init proc_page_init(void)\n--\nfs/proc/page.c-293-\tproc_create(\"kpageflags\", S_IRUSR, NULL, \u0026kpageflags_proc_ops);\nfs/proc/page.c:294:#ifdef CONFIG_MEMCG\nfs/proc/page.c-295-\tproc_create(\"kpagecgroup\", S_IRUSR, NULL, \u0026kpagecgroup_proc_ops);\n--\ninclude/linux/bpf.h=296=struct bpf_map {\n--\ninclude/linux/bpf.h-315-\tstruct btf *btf;\ninclude/linux/bpf.h:316:#ifdef CONFIG_MEMCG\ninclude/linux/bpf.h-317-\tstruct obj_cgroup *objcg;\n--\ninclude/linux/bpf.h=2654=int bpf_map_alloc_pages(const struct bpf_map *map, int nid,\ninclude/linux/bpf.h-2655-\t\t\tunsigned long nr_pages, struct page **page_array);\ninclude/linux/bpf.h:2656:#ifdef CONFIG_MEMCG\ninclude/linux/bpf.h-2657-void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg,\n--\ninclude/linux/cgroup_subsys.h=25=SUBSYS(io)\n--\ninclude/linux/cgroup_subsys.h-27-\ninclude/linux/cgroup_subsys.h:28:#if IS_ENABLED(CONFIG_MEMCG)\ninclude/linux/cgroup_subsys.h-29-SUBSYS(memory)\n--\ninclude/linux/list_lru.h=51=struct list_lru {\ninclude/linux/list_lru.h-52-\tstruct list_lru_node\t*node;\ninclude/linux/list_lru.h:53:#ifdef CONFIG_MEMCG\ninclude/linux/list_lru.h-54-\tstruct list_head\tlist;\n--\ninclude/linux/list_lru.h=82=int memcg_list_lru_alloc(struct mem_cgroup *memcg, struct list_lru *lru,\n--\ninclude/linux/list_lru.h-84-\ninclude/linux/list_lru.h:85:#ifdef CONFIG_MEMCG\ninclude/linux/list_lru.h-86-/**\n--\ninclude/linux/memcontrol.h=60=struct mem_cgroup_reclaim_cookie {\n--\ninclude/linux/memcontrol.h-64-\ninclude/linux/memcontrol.h:65:#ifdef CONFIG_MEMCG\ninclude/linux/memcontrol.h-66-\n--\ninclude/linux/memcontrol.h=89=struct mem_cgroup_per_node {\n--\ninclude/linux/memcontrol.h-97-\ninclude/linux/memcontrol.h:98:#ifdef CONFIG_MEMCG_V1\ninclude/linux/memcontrol.h-99-\t/*\n--\ninclude/linux/memcontrol.h-128-\ninclude/linux/memcontrol.h:129:#ifdef CONFIG_MEMCG_NMI_SAFETY_REQUIRES_ATOMIC\ninclude/linux/memcontrol.h-130-\t/* slab stats for nmi context */\n--\ninclude/linux/memcontrol.h=202=struct mem_cgroup {\n--\ninclude/linux/memcontrol.h-257-\ninclude/linux/memcontrol.h:258:#ifdef CONFIG_MEMCG_NMI_SAFETY_REQUIRES_ATOMIC\ninclude/linux/memcontrol.h-259-\t/* MEMCG_KMEM for nmi context */\n--\ninclude/linux/memcontrol.h-285-\ninclude/linux/memcontrol.h:286:#ifdef CONFIG_MEMCG_V1\ninclude/linux/memcontrol.h-287-\t/* Legacy consumer-oriented counters */\n--\ninclude/linux/memcontrol.h-320-\tspinlock_t event_list_lock;\ninclude/linux/memcontrol.h:321:#endif /* CONFIG_MEMCG_V1 */\ninclude/linux/memcontrol.h-322-\n--\ninclude/linux/memcontrol.h=335=enum page_memcg_data_flags {\n--\ninclude/linux/memcontrol.h-346-\ninclude/linux/memcontrol.h:347:#else /* CONFIG_MEMCG */\ninclude/linux/memcontrol.h-348-\n--\ninclude/linux/memcontrol.h-351-\ninclude/linux/memcontrol.h:352:#endif /* CONFIG_MEMCG */\ninclude/linux/memcontrol.h-353-\ninclude/linux/memcontrol.h=354=enum objext_flags {\n--\ninclude/linux/memcontrol.h-367-\ninclude/linux/memcontrol.h:368:#ifdef CONFIG_MEMCG\ninclude/linux/memcontrol.h-369-/*\n--\ninclude/linux/memcontrol.h=1027=extern int mem_cgroup_init(void);\ninclude/linux/memcontrol.h:1028:#else /* CONFIG_MEMCG */\ninclude/linux/memcontrol.h-1029-\n--\ninclude/linux/memcontrol.h=1440=static inline int mem_cgroup_init(void) { return 0; }\ninclude/linux/memcontrol.h:1441:#endif /* CONFIG_MEMCG */\ninclude/linux/memcontrol.h-1442-\n--\ninclude/linux/memcontrol.h=1447=struct slabobj_ext {\ninclude/linux/memcontrol.h:1448:#ifdef CONFIG_MEMCG\ninclude/linux/memcontrol.h-1449-\tstruct obj_cgroup *objcg;\n--\ninclude/linux/memcontrol.h=1585=struct sock;\ninclude/linux/memcontrol.h:1586:#ifdef CONFIG_MEMCG\ninclude/linux/memcontrol.h-1587-extern struct static_key_false memcg_sockets_enabled_key;\n--\ninclude/linux/memcontrol.h=1673=static inline int shrinker_id(struct shrinker *shrinker)\n--\ninclude/linux/memcontrol.h-1678-\ninclude/linux/memcontrol.h:1679:#ifdef CONFIG_MEMCG\ninclude/linux/memcontrol.h-1680-bool mem_cgroup_kmem_disabled(void);\n--\ninclude/linux/memcontrol.h=1841=static inline bool memcg_is_dying(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-1844-}\ninclude/linux/memcontrol.h:1845:#endif /* CONFIG_MEMCG */\ninclude/linux/memcontrol.h-1846-\ninclude/linux/memcontrol.h:1847:#if defined(CONFIG_MEMCG) \u0026\u0026 defined(CONFIG_ZSWAP)\ninclude/linux/memcontrol.h-1848-bool obj_cgroup_may_zswap(struct obj_cgroup *objcg);\n--\ninclude/linux/memcontrol.h=1865=static inline bool mem_cgroup_zswap_writeback_enabled(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-1874-\ninclude/linux/memcontrol.h:1875:#ifdef CONFIG_MEMCG_V1\ninclude/linux/memcontrol.h-1876-unsigned long memcg1_soft_limit_reclaim(pg_data_t *pgdat, int order,\n--\ninclude/linux/memcontrol.h=1893=static inline void mem_cgroup_exit_user_fault(void)\n--\ninclude/linux/memcontrol.h-1898-\ninclude/linux/memcontrol.h:1899:#else /* CONFIG_MEMCG_V1 */\ninclude/linux/memcontrol.h-1900-static inline\n--\ninclude/linux/memcontrol.h=1922=static inline void mem_cgroup_exit_user_fault(void)\n--\ninclude/linux/memcontrol.h-1925-\ninclude/linux/memcontrol.h:1926:#endif /* CONFIG_MEMCG_V1 */\ninclude/linux/memcontrol.h-1927-\ninclude/linux/memcontrol.h:1928:#if defined(CONFIG_MEMCG_V1) \u0026\u0026 defined(CONFIG_SWAP)\ninclude/linux/memcontrol.h-1929-\n--\ninclude/linux/mm_inline.h=47=static __always_inline void update_lru_size(struct lruvec *lruvec,\n--\ninclude/linux/mm_inline.h-51-\t__update_lru_size(lruvec, lru, zid, nr_pages);\ninclude/linux/mm_inline.h:52:#ifdef CONFIG_MEMCG\ninclude/linux/mm_inline.h-53-\tmem_cgroup_update_lru_size(lruvec, lru, zid, nr_pages);\n--\ninclude/linux/mm_types.h=79=struct page {\n--\ninclude/linux/mm_types.h-185-\ninclude/linux/mm_types.h:186:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-187-\tunsigned long memcg_data;\n--\ninclude/linux/mm_types.h=312=typedef swp_entry_t softleaf_t;\ninclude/linux/mm_types.h-313-\ninclude/linux/mm_types.h:314:#if defined(CONFIG_MEMCG) || defined(CONFIG_SLAB_OBJ_EXT)\ninclude/linux/mm_types.h-315-/* We have some extra room after the refcount in tail pages. */\n--\ninclude/linux/mm_types.h=401=struct folio {\n--\ninclude/linux/mm_types.h-431-\t\t\tatomic_t _refcount;\ninclude/linux/mm_types.h:432:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-433-\t\t\tunsigned long memcg_data;\n--\ninclude/linux/mm_types.h=517=FOLIO_MATCH(_refcount, _refcount);\ninclude/linux/mm_types.h:518:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-519-FOLIO_MATCH(memcg_data, memcg_data);\n--\ninclude/linux/mm_types.h=572=struct ptdesc {\n--\ninclude/linux/mm_types.h-603-\tatomic_t __page_refcount;\ninclude/linux/mm_types.h:604:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-605-\tunsigned long pt_memcg_data;\n--\ninclude/linux/mm_types.h=618=TABLE_MATCH(_refcount, __page_refcount);\ninclude/linux/mm_types.h:619:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-620-TABLE_MATCH(memcg_data, pt_memcg_data);\n--\ninclude/linux/mm_types.h=1159=struct mm_struct {\n--\ninclude/linux/mm_types.h-1318-#endif\ninclude/linux/mm_types.h:1319:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-1320-\t\t/*\n--\ninclude/linux/mm_types.h-1404-\t\t\tunsigned long bitmap;\ninclude/linux/mm_types.h:1405:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-1406-\t\t\t/* points to the memcg of \"owner\" above */\n--\ninclude/linux/mm_types.h=1494=static inline void lru_gen_init_mm(struct mm_struct *mm)\n--\ninclude/linux/mm_types.h-1497-\tmm-\u003elru_gen.bitmap = 0;\ninclude/linux/mm_types.h:1498:#ifdef CONFIG_MEMCG\ninclude/linux/mm_types.h-1499-\tmm-\u003elru_gen.memcg = NULL;\n--\ninclude/linux/mmzone.h=758=struct lruvec {\n--\ninclude/linux/mmzone.h-782-#endif /* CONFIG_LRU_GEN */\ninclude/linux/mmzone.h:783:#ifdef CONFIG_MEMCG\ninclude/linux/mmzone.h-784-\tstruct pglist_data *pgdat;\n--\ninclude/linux/mmzone.h=1652=static inline struct pglist_data *lruvec_pgdat(struct lruvec *lruvec)\ninclude/linux/mmzone.h-1653-{\ninclude/linux/mmzone.h:1654:#ifdef CONFIG_MEMCG\ninclude/linux/mmzone.h-1655-\treturn lruvec-\u003epgdat;\n--\ninclude/linux/page_counter.h=90=static inline void page_counter_reset_watermark(struct page_counter *counter)\n--\ninclude/linux/page_counter.h-101-\ninclude/linux/page_counter.h:102:#if IS_ENABLED(CONFIG_MEMCG) || IS_ENABLED(CONFIG_CGROUP_DMEM)\ninclude/linux/page_counter.h-103-void page_counter_calculate_protection(struct page_counter *root,\n--\ninclude/linux/sched.h=820=struct task_struct {\n--\ninclude/linux/sched.h-1013-#endif\ninclude/linux/sched.h:1014:#ifdef CONFIG_MEMCG_V1\ninclude/linux/sched.h-1015-\tunsigned\t\t\tin_user_fault:1;\n--\ninclude/linux/sched.h-1529-\ninclude/linux/sched.h:1530:#ifdef CONFIG_MEMCG_V1\ninclude/linux/sched.h-1531-\tstruct mem_cgroup\t\t*memcg_in_oom;\n--\ninclude/linux/sched.h-1533-\ninclude/linux/sched.h:1534:#ifdef CONFIG_MEMCG\ninclude/linux/sched.h-1535-\t/* Number of pages to reclaim on returning to userland: */\n--\ninclude/linux/sched/mm.h=161=extern void exec_mm_release(struct task_struct *, struct mm_struct *);\ninclude/linux/sched/mm.h-162-\ninclude/linux/sched/mm.h:163:#ifdef CONFIG_MEMCG\ninclude/linux/sched/mm.h-164-extern void mm_update_next_owner(struct mm_struct *mm);\n--\ninclude/linux/sched/mm.h=166=static inline void mm_update_next_owner(struct mm_struct *mm)\n--\ninclude/linux/sched/mm.h-168-}\ninclude/linux/sched/mm.h:169:#endif /* CONFIG_MEMCG */\ninclude/linux/sched/mm.h-170-\n--\ninclude/linux/sched/mm.h=469=static inline void memalloc_pin_restore(unsigned int flags)\n--\ninclude/linux/sched/mm.h-473-\ninclude/linux/sched/mm.h:474:#ifdef CONFIG_MEMCG\ninclude/linux/sched/mm.h-475-DECLARE_PER_CPU(struct mem_cgroup *, int_active_memcg);\n--\ninclude/linux/shrinker.h=82=struct shrinker {\n--\ninclude/linux/shrinker.h-106-\tstruct list_head list;\ninclude/linux/shrinker.h:107:#ifdef CONFIG_MEMCG\ninclude/linux/shrinker.h-108-\t/* ID in shrinker_idr */\n--\ninclude/linux/slab.h=26=enum _slab_flag_bits {\n--\ninclude/linux/slab.h-45-#endif\ninclude/linux/slab.h:46:#ifdef CONFIG_MEMCG\ninclude/linux/slab.h-47-\t_SLAB_ACCOUNT,\n--\ninclude/linux/slab.h-201- */\ninclude/linux/slab.h:202:#ifdef CONFIG_MEMCG\ninclude/linux/slab.h-203-# define SLAB_ACCOUNT\t\t__SLAB_FLAG_BIT(_SLAB_ACCOUNT)\n--\ninclude/linux/slab.h=629=enum kmalloc_cache_type {\n--\ninclude/linux/slab.h-633-#endif\ninclude/linux/slab.h:634:#ifndef CONFIG_MEMCG\ninclude/linux/slab.h-635-\tKMALLOC_CGROUP = KMALLOC_NORMAL,\n--\ninclude/linux/slab.h-646-#endif\ninclude/linux/slab.h:647:#ifdef CONFIG_MEMCG\ninclude/linux/slab.h-648-\tKMALLOC_CGROUP,\n--\ninclude/linux/slab.h=655=extern kmem_buckets kmalloc_caches[NR_KMALLOC_TYPES];\n--\ninclude/linux/slab.h-662-\t(IS_ENABLED(CONFIG_ZONE_DMA)   ? __GFP_DMA : 0) |\t\\\ninclude/linux/slab.h:663:\t(IS_ENABLED(CONFIG_MEMCG) ? __GFP_ACCOUNT : 0))\ninclude/linux/slab.h-664-\n--\ninclude/linux/slab.h=667=static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags, unsigned long caller)\n--\ninclude/linux/slab.h-690-\t\treturn KMALLOC_DMA;\ninclude/linux/slab.h:691:\tif (!IS_ENABLED(CONFIG_MEMCG) || (flags \u0026 __GFP_RECLAIMABLE))\ninclude/linux/slab.h-692-\t\treturn KMALLOC_RECLAIM;\n--\ninclude/linux/slab.h=770=void *kmem_cache_alloc_lru_noprof(struct kmem_cache *s, struct list_lru *lru,\n--\ninclude/linux/slab.h-793- *\ninclude/linux/slab.h:794: * 1. For !CONFIG_MEMCG or cgroup_disable=memory systems.\ninclude/linux/slab.h-795- * 2. Already charged slab objects.\n--\ninclude/linux/swap.h=534=static inline int add_swap_extent(struct swap_info_struct *sis,\n--\ninclude/linux/swap.h-540-#endif /* CONFIG_SWAP */\ninclude/linux/swap.h:541:#ifdef CONFIG_MEMCG\ninclude/linux/swap.h-542-static inline int mem_cgroup_swappiness(struct mem_cgroup *memcg)\n--\ninclude/linux/swap.h=557=static inline int mem_cgroup_swappiness(struct mem_cgroup *mem)\n--\ninclude/linux/swap.h-562-\ninclude/linux/swap.h:563:#if defined(CONFIG_SWAP) \u0026\u0026 defined(CONFIG_MEMCG) \u0026\u0026 defined(CONFIG_BLK_CGROUP)\ninclude/linux/swap.h-564-void __folio_throttle_swaprate(struct folio *folio, gfp_t gfp);\n--\ninclude/linux/swap.h=572=static inline void folio_throttle_swaprate(struct folio *folio, gfp_t gfp)\n--\ninclude/linux/swap.h-576-\ninclude/linux/swap.h:577:#if defined(CONFIG_MEMCG) \u0026\u0026 defined(CONFIG_SWAP)\ninclude/linux/swap.h-578-int __mem_cgroup_try_charge_swap(struct folio *folio);\n--\ninclude/linux/vmpressure.h=30=struct mem_cgroup;\ninclude/linux/vmpressure.h-31-\ninclude/linux/vmpressure.h:32:#ifdef CONFIG_MEMCG\ninclude/linux/vmpressure.h-33-void vmpressure(gfp_t gfp, int order, struct mem_cgroup *memcg, bool tree,\n--\ninclude/linux/vmpressure.h=50=static inline void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg,\ninclude/linux/vmpressure.h-51-\t\t\t\t   int prio) {}\ninclude/linux/vmpressure.h:52:#endif /* CONFIG_MEMCG */\ninclude/linux/vmpressure.h-53-#endif /* __LINUX_VMPRESSURE_H */\n--\ninclude/linux/vmstat.h=507=static inline const char *vm_event_name(enum vm_event_item item)\n--\ninclude/linux/vmstat.h-516-\ninclude/linux/vmstat.h:517:#ifdef CONFIG_MEMCG\ninclude/linux/vmstat.h-518-\n--\ninclude/linux/vmstat.h=545=static inline void mod_lruvec_page_state(struct page *page,\n--\ninclude/linux/vmstat.h-550-\ninclude/linux/vmstat.h:551:#endif /* CONFIG_MEMCG */\ninclude/linux/vmstat.h-552-\n--\ninclude/net/sock.h=365=struct sock {\n--\ninclude/net/sock.h-460-\tstruct socket\t\t*sk_socket;\ninclude/net/sock.h:461:#ifdef CONFIG_MEMCG\ninclude/net/sock.h-462-\tstruct mem_cgroup\t*sk_memcg;\n--\ninclude/net/sock.h=2662=static inline gfp_t gfp_memcg_charge(void)\n--\ninclude/net/sock.h-2666-\ninclude/net/sock.h:2667:#ifdef CONFIG_MEMCG\ninclude/net/sock.h-2668-static inline struct mem_cgroup *mem_cgroup_from_sk(const struct sock *sk)\n--\ninclude/net/sock.h=2678=static inline bool mem_cgroup_sk_under_memory_pressure(const struct sock *sk)\n--\ninclude/net/sock.h-2681-\ninclude/net/sock.h:2682:#ifdef CONFIG_MEMCG_V1\ninclude/net/sock.h-2683-\tif (!cgroup_subsys_on_dfl(memory_cgrp_subsys))\ninclude/net/sock.h-2684-\t\treturn !!memcg-\u003etcpmem_pressure;\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 13680
							output: 21
							thoughts: 0
						

{
  "Expression": "CONFIG_MEMCG_V1"
}

{
  "Output": "include/linux/memcontrol.h=89=struct mem_cgroup_per_node {\n--\ninclude/linux/memcontrol.h-97-\ninclude/linux/memcontrol.h:98:#ifdef CONFIG_MEMCG_V1\ninclude/linux/memcontrol.h-99-\t/*\n--\ninclude/linux/memcontrol.h=202=struct mem_cgroup {\n--\ninclude/linux/memcontrol.h-285-\ninclude/linux/memcontrol.h:286:#ifdef CONFIG_MEMCG_V1\ninclude/linux/memcontrol.h-287-\t/* Legacy consumer-oriented counters */\n--\ninclude/linux/memcontrol.h-320-\tspinlock_t event_list_lock;\ninclude/linux/memcontrol.h:321:#endif /* CONFIG_MEMCG_V1 */\ninclude/linux/memcontrol.h-322-\n--\ninclude/linux/memcontrol.h=1865=static inline bool mem_cgroup_zswap_writeback_enabled(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-1874-\ninclude/linux/memcontrol.h:1875:#ifdef CONFIG_MEMCG_V1\ninclude/linux/memcontrol.h-1876-unsigned long memcg1_soft_limit_reclaim(pg_data_t *pgdat, int order,\n--\ninclude/linux/memcontrol.h=1893=static inline void mem_cgroup_exit_user_fault(void)\n--\ninclude/linux/memcontrol.h-1898-\ninclude/linux/memcontrol.h:1899:#else /* CONFIG_MEMCG_V1 */\ninclude/linux/memcontrol.h-1900-static inline\n--\ninclude/linux/memcontrol.h=1922=static inline void mem_cgroup_exit_user_fault(void)\n--\ninclude/linux/memcontrol.h-1925-\ninclude/linux/memcontrol.h:1926:#endif /* CONFIG_MEMCG_V1 */\ninclude/linux/memcontrol.h-1927-\ninclude/linux/memcontrol.h:1928:#if defined(CONFIG_MEMCG_V1) \u0026\u0026 defined(CONFIG_SWAP)\ninclude/linux/memcontrol.h-1929-\n--\ninclude/linux/sched.h=820=struct task_struct {\n--\ninclude/linux/sched.h-1013-#endif\ninclude/linux/sched.h:1014:#ifdef CONFIG_MEMCG_V1\ninclude/linux/sched.h-1015-\tunsigned\t\t\tin_user_fault:1;\n--\ninclude/linux/sched.h-1529-\ninclude/linux/sched.h:1530:#ifdef CONFIG_MEMCG_V1\ninclude/linux/sched.h-1531-\tstruct mem_cgroup\t\t*memcg_in_oom;\n--\ninclude/net/sock.h=2678=static inline bool mem_cgroup_sk_under_memory_pressure(const struct sock *sk)\n--\ninclude/net/sock.h-2681-\ninclude/net/sock.h:2682:#ifdef CONFIG_MEMCG_V1\ninclude/net/sock.h-2683-\tif (!cgroup_subsys_on_dfl(memory_cgrp_subsys))\ninclude/net/sock.h-2684-\t\treturn !!memcg-\u003etcpmem_pressure;\ninclude/net/sock.h:2685:#endif /* CONFIG_MEMCG_V1 */\ninclude/net/sock.h-2686-\n--\nmm/Makefile=103=obj-$(CONFIG_LIVEUPDATE_MEMFD) += memfd_luo.o\nmm/Makefile:104:obj-$(CONFIG_MEMCG_V1) += memcontrol-v1.o\nmm/Makefile-105-obj-$(CONFIG_MEMCG) += memcontrol.o vmpressure.o\n--\nmm/memcontrol-v1.h=30=struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg,\n--\nmm/memcontrol-v1.h-33-/* Cgroup v1-specific declarations */\nmm/memcontrol-v1.h:34:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol-v1.h-35-\n--\nmm/memcontrol-v1.h=97=extern struct cftype mem_cgroup_legacy_files[];\nmm/memcontrol-v1.h-98-\nmm/memcontrol-v1.h:99:#else\t/* CONFIG_MEMCG_V1 */\nmm/memcontrol-v1.h-100-\n--\nmm/memcontrol-v1.h=127=static inline void memcg1_uncharge_skmem(struct mem_cgroup *memcg, unsigned int nr_pages) {}\nmm/memcontrol-v1.h-128-\nmm/memcontrol-v1.h:129:#endif\t/* CONFIG_MEMCG_V1 */\nmm/memcontrol-v1.h-130-\n--\nmm/memcontrol.c=209=static inline struct obj_cgroup *__memcg_reparent_objcgs(struct mem_cgroup *memcg,\n--\nmm/memcontrol.c-228-\nmm/memcontrol.c:229:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-230-static void __mem_cgroup_flush_stats(struct mem_cgroup *memcg, bool force);\n--\nmm/memcontrol.c=505=unsigned long lruvec_page_state_local(struct lruvec *lruvec,\n--\nmm/memcontrol.c-527-\nmm/memcontrol.c:528:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-529-static void __mod_memcg_lruvec_state(struct mem_cgroup_per_node *pn,\n--\nmm/memcontrol.c=553=static const unsigned int memcg_vm_event_stat[] = {\nmm/memcontrol.c:554:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-555-\tPGPGIN,\n--\nmm/memcontrol.c=787=static long memcg_state_val_in_pages(int idx, long val)\n--\nmm/memcontrol.c-802-\nmm/memcontrol.c:803:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-804-/*\n--\nmm/memcontrol.c=871=void mod_memcg_state(struct mem_cgroup *memcg, enum memcg_stat_item idx,\n--\nmm/memcontrol.c-883-\nmm/memcontrol.c:884:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-885-/* idx can be of type enum memcg_stat_item or node_stat_item. */\n--\nmm/memcontrol.c=1059=bool memcg_vm_event_item_valid(enum vm_event_item idx)\n--\nmm/memcontrol.c-1066-\nmm/memcontrol.c:1067:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1068-unsigned long memcg_events_local(struct mem_cgroup *memcg, int event)\n--\nmm/memcontrol.c=1667=unsigned long memcg_page_state_output(struct mem_cgroup *memcg, int item)\n--\nmm/memcontrol.c-1672-\nmm/memcontrol.c:1673:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1674-unsigned long memcg_page_state_local_output(struct mem_cgroup *memcg, int item)\n--\nmm/memcontrol.c=1693=static void memcg_stat_format(struct mem_cgroup *memcg, struct seq_buf *s)\n--\nmm/memcontrol.c-1739-\tfor (i = 0; i \u003c ARRAY_SIZE(memcg_vm_event_stat); i++) {\nmm/memcontrol.c:1740:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1741-\t\tif (memcg_vm_event_stat[i] == PGPGIN ||\n--\nmm/memcontrol.c=1791=void mem_cgroup_print_oom_meminfo(struct mem_cgroup *memcg)\n--\nmm/memcontrol.c-1812-\t\t\tatomic_long_read(\u0026memcg-\u003ememory_events[MEMCG_SWAP_MAX]));\nmm/memcontrol.c:1813:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1814-\telse {\n--\nmm/memcontrol.c=4156=mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)\n--\nmm/memcontrol.c-4179-\t\tpage_counter_init(\u0026memcg-\u003eswap, \u0026parent-\u003eswap, false);\nmm/memcontrol.c:4180:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-4181-\t\tmemcg-\u003ememory.track_failcnt = !memcg_on_dfl;\n--\nmm/memcontrol.c-4190-\t\tpage_counter_init(\u0026memcg-\u003eswap, NULL, false);\nmm/memcontrol.c:4191:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-4192-\t\tpage_counter_init(\u0026memcg-\u003ekmem, NULL, false);\n--\nmm/memcontrol.c=4358=static void mem_cgroup_css_reset(struct cgroup_subsys_state *css)\n--\nmm/memcontrol.c-4363-\tpage_counter_set_max(\u0026memcg-\u003eswap, PAGE_COUNTER_MAX);\nmm/memcontrol.c:4364:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-4365-\tpage_counter_set_max(\u0026memcg-\u003ekmem, PAGE_COUNTER_MAX);\n--\nmm/memcontrol.c=5081=struct cgroup_subsys memory_cgrp_subsys = {\n--\nmm/memcontrol.c-5092-\t.dfl_cftypes = memory_files,\nmm/memcontrol.c:5093:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-5094-\t.legacy_cftypes = mem_cgroup_legacy_files,\n--\nmm/memcontrol.c=6027=static int __init mem_cgroup_swap_init(void)\n--\nmm/memcontrol.c-6032-\tWARN_ON(cgroup_add_dfl_cftypes(\u0026memory_cgrp_subsys, swap_files));\nmm/memcontrol.c:6033:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-6034-\tWARN_ON(cgroup_add_legacy_cftypes(\u0026memory_cgrp_subsys, memsw_files));\n"
}

gemini-3.1-pro-preview

null

null

							input: 16503
							output: 18
							thoughts: 514
						

**Analyzing a Patch: Safeguarding Memory Control in Dying cgroups**

Okay, so I'm looking at this patch and it's making a small, but potentially important, change. They're adding `if (memcg_is_dying(memcg)) break;` to three functions. The functions are `memory_high_write` and `memory_max_write` (both in `mm/memcontrol.c`) and `user_proactive_reclaim` (in `mm/vmscan.c`). These are all clearly tied to cgroup memory control, or memcg, which is interesting.

`memory_high_write` and `memory_max_write` are the write handlers for the `memory.high` and `memory.max` files in cgroup v2, so that's pretty straightforward. `user_proactive_reclaim` is where it gets a little more involved. It's called from `memory_reclaim` which handles writing to the `memory.reclaim` file, also a cgroup v2 file, and `reclaim_store`, which I need to investigate a bit more.

The patch itself looks functional – it's basically preventing work from being done on a memcg that's in the process of being deleted. This seems sensible, as it would prevent potential race conditions or errors, so far, so good. The interesting thing here is that the functions are reachable from userspace just by writing to the appropriate cgroup files, specifically `memory.high`, `memory.max`, or `memory.reclaim`, and that all of this can occur when the cgroup is already being deleted.

Let's do some config checks to see how this all fits together. `CONFIG_MEMCG` is the main one, of course, for memory cgroups. I'm assuming that it is linked to each of those functions, but let's just make sure.

`memory_high_write` and `memory_max_write` are definitely within `mm/memcontrol.c` and under `CONFIG_MEMCG`. Good. Now, what about `user_proactive_reclaim`? Let's check the code:

```c
int user_proactive_reclaim(char *buf,
			   struct mem_cgroup *memcg, pg_data_t *pgdat)
{
	...
	if (memcg) {
		unsigned int reclaim_options;

		if (memcg_is_dying(memcg))
			break;
		...
```

Ah, `user_proactive_reclaim` checks for the memcg being dead *inside* the function. Makes sense, because it is called from two other places, one of them, `memory_reclaim`, is under `CONFIG_MEMCG`. But what about the other? I recall that it is from `reclaim_store`, which is under `CONFIG_NUMA`, which calls this function. Hmm. Need to confirm that. Let's look at `reclaim_store` in `mm/vmscan.c` to be sure.

{
  "Expression": "reclaim_store"
}

{
  "Output": "fs/btrfs/sysfs.c=952=static ssize_t btrfs_sinfo_dynamic_reclaim_show(struct kobject *kobj,\n--\nfs/btrfs/sysfs.c-960-\nfs/btrfs/sysfs.c:961:static ssize_t btrfs_sinfo_dynamic_reclaim_store(struct kobject *kobj,\nfs/btrfs/sysfs.c-962-\t\t\t\t\t\t struct kobj_attribute *a,\n--\nfs/btrfs/sysfs.c=981=BTRFS_ATTR_RW(space_info, dynamic_reclaim,\nfs/btrfs/sysfs.c-982-\t      btrfs_sinfo_dynamic_reclaim_show,\nfs/btrfs/sysfs.c:983:\t      btrfs_sinfo_dynamic_reclaim_store);\nfs/btrfs/sysfs.c-984-\nfs/btrfs/sysfs.c=985=static ssize_t btrfs_sinfo_periodic_reclaim_show(struct kobject *kobj,\n--\nfs/btrfs/sysfs.c-993-\nfs/btrfs/sysfs.c:994:static ssize_t btrfs_sinfo_periodic_reclaim_store(struct kobject *kobj,\nfs/btrfs/sysfs.c-995-\t\t\t\t\t\t struct kobj_attribute *a,\n--\nfs/btrfs/sysfs.c=1014=BTRFS_ATTR_RW(space_info, periodic_reclaim,\nfs/btrfs/sysfs.c-1015-\t      btrfs_sinfo_periodic_reclaim_show,\nfs/btrfs/sysfs.c:1016:\t      btrfs_sinfo_periodic_reclaim_store);\nfs/btrfs/sysfs.c-1017-\n--\nmm/vmscan.c=8009=EXPORT_SYMBOL_GPL(check_move_unevictable_folios);\n--\nmm/vmscan.c-8011-#if defined(CONFIG_SYSFS) \u0026\u0026 defined(CONFIG_NUMA)\nmm/vmscan.c:8012:static ssize_t reclaim_store(struct device *dev,\nmm/vmscan.c-8013-\t\t\t     struct device_attribute *attr,\n"
}

gemini-3.1-pro-preview

null

null

							input: 18991
							output: 21
							thoughts: 246
						

**Analyzing the `reclaim_store` Configuration Dependency**

Okay, so `reclaim_store` is nested under `CONFIG_SYSFS` and `CONFIG_NUMA`, which makes sense. But this patch is adding that `if (memcg_is_dying(memcg))` check *inside* the `if (memcg)` block within `user_proactive_reclaim`. This means it *only* affects the memcg path, right? Therefore, `CONFIG_MEMCG` is the real deciding factor here. It's the only one that really matters for whether this change even does anything.

Hang on a second… `memcg_is_dying` is defined in `include/linux/memcontrol.h`. Let me quickly look at that definition:

```c
static inline bool memcg_is_dying(struct mem_cgroup *memcg)
{
	return !(memcg->css.flags & CSS_ONLINE);
}
```

Okay, so it checks `CSS_ONLINE`. But... wait! `memcg_is_dying` is *only* available if `CONFIG_MEMCG` is enabled! If it's disabled, then the function might not even be defined, or it might be defined to a default of `false`. I need to verify that. Let me quickly check that header file and see what happens when `CONFIG_MEMCG` is not set. This is crucial for understanding the impact of this conditional code.

{
  "Expression": "memcg_is_dying"
}

{
  "Output": "include/linux/memcontrol.h=1763=void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);\ninclude/linux/memcontrol.h-1764-\ninclude/linux/memcontrol.h:1765:static inline bool memcg_is_dying(struct mem_cgroup *memcg)\ninclude/linux/memcontrol.h-1766-{\n--\ninclude/linux/memcontrol.h=1837=static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-1840-\ninclude/linux/memcontrol.h:1841:static inline bool memcg_is_dying(struct mem_cgroup *memcg)\ninclude/linux/memcontrol.h-1842-{\n--\nmm/memcontrol.c=808=static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg,\n--\nmm/memcontrol.c-819-\nmm/memcontrol.c:820:\twhile (memcg_is_dying(memcg))\nmm/memcontrol.c-821-\t\tmemcg = parent_mem_cgroup(memcg);\n--\nmm/memcontrol.c=4767=static ssize_t memory_high_write(struct kernfs_open_file *of,\n--\nmm/memcontrol.c-4795-\nmm/memcontrol.c:4796:\t\tif (memcg_is_dying(memcg))\nmm/memcontrol.c-4797-\t\t\tbreak;\n--\nmm/memcontrol.c=4822=static ssize_t memory_max_write(struct kernfs_open_file *of,\n--\nmm/memcontrol.c-4849-\nmm/memcontrol.c:4850:\t\tif (memcg_is_dying(memcg))\nmm/memcontrol.c-4851-\t\t\tbreak;\n--\nmm/vmscan.c=7866=int user_proactive_reclaim(char *buf,\n--\nmm/vmscan.c-7924-\nmm/vmscan.c:7925:\t\t\tif (memcg_is_dying(memcg))\nmm/vmscan.c-7926-\t\t\t\tbreak;\n"
}

gemini-3.1-pro-preview

null

null

							input: 18737
							output: 192
							thoughts: 0
						

{
  "EnableConfigs": [
    "MEMCG"
  ],
  "FocusSymbols": [
    "memory_high_write",
    "memory_max_write",
    "user_proactive_reclaim"
  ],
  "Reasoning": "The patch adds checks for `memcg_is_dying(memcg)` in `memory_high_write`, `memory_max_write` (in mm/memcontrol.c), and `user_proactive_reclaim` (in mm/vmscan.c). These functions are reachable via cgroupfs writes (`memory.high`, `memory.max`, `memory.reclaim`) and sysfs writes (`reclaim`). The changes are functional as they alter the execution flow by breaking out of loops if the memory cgroup is dying. The code is guarded by CONFIG_MEMCG, which needs to be enabled.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MEMCG"
  ],
  "FocusSymbols": [
    "memory_high_write",
    "memory_max_write",
    "user_proactive_reclaim"
  ],
  "Reasoning": "The patch adds checks for `memcg_is_dying(memcg)` in `memory_high_write`, `memory_max_write` (in mm/memcontrol.c), and `user_proactive_reclaim` (in mm/vmscan.c). These functions are reachable via cgroupfs writes (`memory.high`, `memory.max`, `memory.reclaim`) and sysfs writes (`reclaim`). The changes are functional as they alter the execution flow by breaking out of loops if the memory cgroup is dying. The code is guarded by CONFIG_MEMCG, which needs to be enabled.",
  "WorthFuzzing": true
}